phacility/phabricator · error · Exception

Failed to generate an intracluster proxy URI even though thi

Error message

Failed to generate an intracluster proxy URI even though this request was routed as a proxy request.

What it means

For repositories bound to an Almanac cluster service, an SSH request that is itself already a cluster request must be served locally (neverProxy). getAlmanacServiceRefs then asks the repository for service refs filtered to the ssh protocol, the required writability, and no-proxy mode; an empty result means this host cannot legally serve the repository and no proxy target exists either, so it throws.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:93

  final protected function getAlmanacServiceRefs($for_write) {
    $viewer = $this->getSSHUser();
    $repository = $this->getRepository();

    $is_cluster_request = $this->getIsClusterRequest();

    $refs = $repository->getAlmanacServiceRefs(
      $viewer,
      array(
        'neverProxy' => $is_cluster_request,
        'protocols' => array(
          'ssh',
        ),
        'writable' => $for_write,
      ));

    if (!$refs) {
      throw new Exception(
        pht(
          'Failed to generate an intracluster proxy URI even though this '.
          'request was routed as a proxy request.'));
    }

    return $refs;
  }

  final protected function getProxyCommand($for_write) {
    $refs = $this->getAlmanacServiceRefs($for_write);

    $ref = head($refs);

    return $this->getProxyCommandForServiceRef($ref);
  }

  final protected function getProxyCommandForServiceRef(
    DiffusionServiceRef $ref) {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Open the repository's Almanac service and verify every cluster device is bound with an ssh interface
2. Confirm the repository's URI list actually binds the cluster service you expect (Manage -> URIs)
3. For writes, ensure at least one bound device is writable
4. Run bin/almanac register on each device and re-test the operation

try {
  $refs = $workflow->getAlmanacServiceRefs($for_write);
} catch (Exception $ex) {
  // Cluster topology cannot serve this request: surface an operational
  // alert pointing at the repository's Almanac bindings and device registration.
  throw new PhabricatorApplicationTransactionValidationErrorException(
    null, pht('Cluster'), $ex->getMessage());
}

When it happens

Trigger: A device-authenticated or proxied SSH operation against a clusterized repository where no matching SSH service binding is visible: the device is not bound to the service, the service lacks ssh interfaces, or a write arrives with no writable nodes bound.

Common situations: Half-finished cluster setups (repo bound to a service, devices registered, bindings or interfaces incomplete); Almanac network mismatches; read-only services receiving pushes.

Related errors

• Unable to proxy this SSH request within the cluster: this de
• This host has device ID "%s", but there is no corresponding
• Failed to load repository cluster service.
• Repository "%s" exists on more than one device, but no devic
• Repository "%s" is being synchronized on device "%s", but th

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/ead0b8b6a24fcdb1. Report an issue: GitHub.